Appl.No. 09/491,727 
Appeal Brief dated July 24, 2007 
Appeal Brief TransjjH^t^ejyuly 24, 2007 



ftp 




CERTIFICATE OF MAILING 

I hereby certif^tffouhis corresjjoffi^nce is being deposited with the United States Postal Service as first class mail in an 
envelope addres^§^ftft|^!^(yAppeal Brief - Patents, Commissioner for Patents, P.O. Box 1450, Alexandria, VA 22313- 
1450, on July 3* 




Attorney for 



PATENT APPLICATION 
Docket No. AUZ-001 P 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



Applicant(s): David M. Austin et al. 



Serial No.: 



09/491,727 



Filed: 



For: 



January 27, 2000 

DETECTION OF OBSERVER PROGRAMS AND 
COUNTERMEASURES AGAINST OBSERVER 
PROGRAMS 



Group Art 
Unit: 2131 



Examiner: 



Syed Zia 



APPEAL BRIEF TRANSMITTAL 



Mail Stop Appeal Brief - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 



Dear Sir: 

Appellants' Appeal Brief is being filed herewith. The fee for filing the Appeal Brief was 
previously submitted on June 20, 2005 . 



Page 1 of 2 



Appl. No. 09/491,727 

Appeal Brief dated July 24, 2007 

Appeal Brief Transmittal of July 24, 2007 



Respectfully submitted, 




Reg. No. 42,273 
Attorney for Appellant(s) 

Date: July 24, 2007 



Wesley L. Austin, Esq. 
Trapware Corporation 
1244 E. 1650 S. 
Bountiful, UT 84010 
Telephone: (801) 537-1700 



Page 2 of 2 



Appl. No. 09/491,727 

Appeal Brief Dated July 24, 2007 

Reply to Office Action of March 9, 2007 




I hereby certify that this correspondence is being dep^rtS£Sl*Se United States Postal Service as first class mail in an 
envelope addressed to: Mail Stop Appeal Brief - Patents, Commissioner for Patents, P.O. Box 1450, Alexandria, VA 22313- 
1450. on July 2y 




Attorney for Ap 



PATENT APPLICATION 
Docket No. AUZ-001 P 



IN THE UNITED STATES PATENT AND TRADEMARK OFFICE 



Applicant(s): David M. Austin et al. 



Serial No.: 



Filed: 



For: 



Examiner: 



09/491,727 
January 27, 2 0 00 

DETECTION OF OBSERVER PROGRAMS AND 
COUNTERMEASURES AGAINST OBSERVER 
PROGRAMS 

Syed Zia 



Group Art 
Unit: 2131 



APPELLANTS' APPEAL BRIEF 



Mail Stop Appeal Brief - Patents 
Commissioner for Patents 
P.O. Box 1450 
Alexandria, VA 22313-1450 

Dear Sir: 
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2. RELATED APPEALS AND INTERFERENCES 

An appeal has been filed in a continuation-in-part patent application, Application No. 
10/027,714. 

3. STATUS OF CLAIMS 

Claims 1-18 are pending in the present application. Claim 19 has been canceled. Claims 
20-32 have been withdrawn from consideration due to a restriction/election requirement. Claims 
1-18 stand rejected under the judicially created doctrine of obviousness-type double patenting 
over claims 1-21 of copending Application No. 10/027,714. Claims 1-18 also stand rejected 
under 35 U.S.C. § 103(a) as being unpatentable over Johnson et al 5 U.S. Patent No. 5,964,839 
(hereinafter, "Johnson") and further in view of Togawa, U.S. Patent No. 6,240,530 (hereinafter, 
"Togawa"). 

Appellants appeal the rejections of claims 1-18. 

4. STATUS OF AMENDMENTS 

No amendments were filed subsequent to the rejection. 

5.. SUMMARY OF CLAIMED SUBJECT MATTER 

As stated in the background section of the patent application, software has been developed 
to observe or monitor computer users. These software programs provide a wide variety of 
monitoring features. For example, some of these programs are able to log keystrokes of a user, log 
menu commands, take screen shots of a user's computer screen at various times, track use of 
various programs, track what web sites have been visited, monitor e-mail communications, etc. 
With the technology available today, most, if not all, of a computer user's activities on a computer 
can be observed and recorded. See the Appellants' patent application (hereinafter referred to as the 
"Specification"), page 3, lines 1-22. 

With the computer technology of today and with the observing programs now available and 
for those programs that will surely be developed and used in the future, computer users may be 
watched by third parties more often than many think. It would be highly beneficial to computer 
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users if they could find out whether they are being observed by computer software and technology 
and to know information about the observing activity and/or program. Specification, page 3, lines 
1-22. 

As presently claimed, a new system has been developed for detecting an observing program 
on a computer system as including accessing instructions that access observer data. One or more 
embodiments of an observer program are described in the Specification on page 14, lines 9-23, page 
15, lines 1-14, and Figure 2. The observer data includes data descriptive of the observer program. 
The observer program is programmed to observe a user's activities on the computer system and also 
operates to create data from its observations. The system also includes reading instructions that read 
memory of the computer system to obtain memory data. Further, the system includes comparing 
instructions that compare the observer data with memory data read in from memory to determine 
whether the observer program is present on the computer system. One or more embodiments of the 
system and how it detects an observer program are described in the Specification on page 1 7, lines 
8-22, page 18, lines 1-23, page 19, lines 1-23, page 20, lines 1-23, page 21, lines 1-23, 9-23, and 
Figure 3. The system also includes generating instructions that generate results from the reading 
and comparing. The results generated indicate whether the observer program is present on the 
computer system. In addition, the system includes outputting instructions that obtain the results and 
provide the results for a user. The outputting instructions may provide the results to a user through a 
graphical user interface. 

As required by 37 C.F.R. § 41.37(c)(l)(v), a summary of claimed subject matter 
immediately follows. The references to the specification refer only to embodiments of the 
invention. The invention is defined by the claims. Accordingly, these references to the 
specification are not meant to limit the scope of the claims of the present invention in any way 
but are only provided because they are mandated by 37 C.F.R. § 41.37(c)(l)(v). All references 
are to the patent specification. 

1 . A system for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
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on the computer system, the system including computer software for running on the computer 

system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 
being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to 
create a log file from the observing of the observer program; (pg. 9, lines 6-8; pg. 
10, lines 4-15; pg. 14, lines 9-23; pg. 15, lines 1-23; pg. 16, lines 1-23; pg. 17, 
lines 1-7; Figure 2, elements 34-48; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, 
lines 1-23) 

accessing instructions that access the observer data; (pg. 9, lines 5-6; pg. 10, lines 16-23; 
pg. 11, lines 1-8; pg. 17, lines 8-23; pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, 
lines 1-23; pg. 21, lines 1-23; Figure 3, elements 50-60; pg. 23, lines 5-23; pg. 24, 
lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; 
Figure 6) 

reading instructions that read memory of the computer system to obtain memory data; 

(pg. 9, lines 8-10; pg. 10, lines 16-23; pg. 11, lines 1-8; pg, 11, lines 9-18; pg. 17, 
lines 8-23; pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1- 
23; Figure 3, elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 
1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

comparing instructions that compare the observer data with memory data read in from 
memory to determine whether the observer program is present on the computer 
system; (pg. 9, lines 10-12, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 18, 
lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 3, 
elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, 
lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

generating instructions that generate results from the comparing, wherein the results 
generated indicate whether the observer program is present on the computer 
system; and (pg. 9, lines 12-15, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 
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22, lines 5-11; Figure 4; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; 
pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

outputting instructions that obtain the results and provide the results for a user. (pg. 1 0, 
lines 1-3; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 22, lines 5-11; Figure 4; pg. 

23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, 
lines 1-23; Figure 5; Figure 6) 

16. A system for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
on the computer system, the system including computer software for running on the computer 
system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 
being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to 
create a log file from the observing of the observer program; (pg. 9, lines 6-8; pg. 
10, lines 4-15; pg. 14, lines 9-23; pg. 15, lines 1-23; pg. 16, lines 1-23; pg. 17, 
lines 1-7; Figure 2, elements 34-48; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, 
lines 1-23) 

means for accessing the observer data; (pg. 9, lines 5-6; pg. 10, lines 16-23; pg. 11, lines 

1-8; pg. 17, lines 8-23; pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; 

pg. 21, lines 1-23; Figure 3, elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; 

pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 
means for reading memory of the computer system to obtain memory data; (pg. 9, lines 

8-10; pg. 10, lines 16-23; pg. 11, lines 1-8; pg, 11, lines 9-18; pg. 17, lines 8-23; 

pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 

3, elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, 

lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 
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means for comparing the observer data with memory data to determine whether the 

observer program is present on the computer system; (pg. 9, lines 10-12, 15-24; 
pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, 
lines 1-23; pg. 21, lines 1-23; Figure 3, elements 50-60; pg. 23, lines 5-23; pg. 24, 
lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; 
Figure 6) 

means for generating results from the comparison, wherein the results generated indicate 
whether the observer program is present on the computer system; and (pg. 9, lines 
12-15, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 22, lines 5-11; Figure 4; 
pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, 
lines 1-23; Figure 5; Figure 6) 

means for outputting the results for a user. (pg. 10, lines 1-3; pg. 10, lines 16-23; pg. 11, 
lines 1-8; pg. 22, lines 5-11; Figure 4; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 
25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

1 7. A method for detecting the presence of an observing program on a computer system, 
wherein the observing program is programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and to create data from the 
observing on the computer system, the method being implemented through computer software 
for running on the computer system, the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an observer 

program, the observer program being programmed to observe a user's activities 
on the computer system by monitoring user input entered through a user input 
device and also operating to create a log file from the observing of the observer 
program; (pg. 9, lines 5-6; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 17, lines 8-23; 
pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 
3, elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, 
lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 
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reading memory of the computer system to obtain memory data; (pg. 9, lines 8-10; pg. 
10, lines 16-23; pg. 11, lines 1-8; pg, 11, lines 9-18; pg. 17, lines 8-23; pg. 18, 
lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 3, 
elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, 
lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

comparing the observer data with memory data read in from memory to determine 

whether the observer program is present on the computer system; (pg. 9, lines 10- 
12, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 18, lines 1-23; pg. 19, lines 1- 
23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 3, elements 50-60; pg. 23, lines 
5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; 
Figure 5; Figure 6) 

generating results from the reading and comparing, wherein the results generated indicate 
whether the observer program is present on the computer system; and (pg. 9, 
lines 12-15, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 22, lines 5-11; Figure 
4; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 
27, lines 1-23; Figure 5; Figure 6) 

outputting the results for a user. (pg. 10, lines 1-3; pg. 10, lines 16-23; pg. 11, lines 1-8; 
pg. 22, lines 5-11; Figure 4; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1- 
23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

18. A computer-readable medium containing instructions for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, wherein the 
instructions are executable to: 

access observer data, the observer data including data descriptive of an observer program, 
the observer program being programmed to observe a user's activities on the 
computer system by monitoring user input entered through a user input device and 
also operating to create a log file from the observing of the observer program; 
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(pg. 9, lines 5-6; pg. 10, lines 16-23; pg. 1 1, lines 1-8; pg. 17, lines 8-23; pg. 18, 
lines 1-23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 3, 
elements 50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, 
lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

read memory of the computer system to obtain memory data; (pg. 9, lines 8-10; pg. 10, 

lines 16-23; pg. 11, lines 1-8; pg, 11, lines 9-18; pg. 17, lines 8-23; pg. 18, lines 1- 
23; pg. 19, lines 1-23; pg. 20, lines 1-23; pg. 21, lines 1-23; Figure 3, elements 
50-60; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; 
pg. 27, lines 1-23; Figure 5; Figure 6) 

compare the observer data with memory data read in from memory to determine whether 
the observer program is present on the computer system; (pg. 9, lines 10-12, 15- 
24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 18, lines 1-23; pg. 19, lines 1-23; pg. 
20, lines 1-23; pg. 21, lines 1-23; Figure 3, elements 50-60; pg. 23, lines 5-23; pg. 
24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; 
Figure 6) 

generate results from the read and compare, wherein the results generated indicate 

whether the observer program is present on the computer system; and (pg. 9, lines 
12-15, 15-24; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 22, lines 5-11; Figure 4; 
pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; pg. 26, lines 1-23; pg. 27, 
lines 1-23; Figure 5; Figure 6) 

output the results for a user. (pg. 10, lines 1-3; pg. 10, lines 16-23; pg. 11, lines 1-8; pg. 
22, lines 5-11; Figure 4; pg. 23, lines 5-23; pg. 24, lines 1-23; pg. 25, lines 1-23; 
pg. 26, lines 1-23; pg. 27, lines 1-23; Figure 5; Figure 6) 

6. GROUNDS OF REJECTIONS TO BE REVIEWED ON APPEAL 
The following issues are presented for review: 

I. Whether the obviousness-type double patenting rejection of claims 1-18 of the present 
application over claims 1-21 of copending Application No. 10/027,714 is proper. 
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II. Whether claims 1-18 are unpatentable under 35 U.S.C. § 103(a) as being obvious over 
Johnson et al, U.S. Patent No. 5,964,839 (hereinafter, "Johnson") and further in view of Togawa, 
U.S. Patent No. 6,240,530 (hereinafter, "Togawa"). 

7. ARGUMENT 

A. Rejection of Claims 1-18 under the Judicially Created Doctrine of Obviousness- 
Type Double Patenting 

The Office Action rejected claims 1-18 under the judicially created doctrine of 
obviousness-type double patenting as being unpatentable over claims 1-21 of copending U.S. 
Patent Application No. 10/027,714. This rejection was a provisional rejection. 

The procedures regarding double patenting rejections of two copending applications are 
set forth in M.P.E.P. § 1490. The M.P.E.P. states that "[i]f the [obviousness-type double 
patenting] rejection is the only rejection remaining in the earlier filed of the two pending 
applications, (but the later filed application is rejectable on other grounds), the examiner should 
then withdraw that rejection and permit the earlier-filed application to issue as a patent without a 
terminal disclaimer." M.P.E.P. § 1490. The present application is the parent, or earlier filed 
application, and therefore if this application were to become allowable before the rejected 
copending application, the Examiner should permit this application to issue without the terminal 
disclaimer. 

Appellants believe this rejection to be improper. The present application was filed on 
January 27, 2000. The copending patent application (U.S. Patent Application No. 10/027,714) is 
a child of the present application and was filed on December 21, 2001. "The doctrine of double 
patenting seeks to prevent the unjustified extension of patent exclusivity beyond the term of a 
patent." M.P.E.P. § 804. In the present application, Appellants cannot conceive of how the term 
of a patent on the present application could be unjustifiably extended. Whether or not an 
obviousness-type double patenting rejection is proper in the child application (U.S. Patent 
Application No. 10/027,714), with a filing date of December 21, 2001, is not the issue. The 
issue presently before the Board of Patent Appeals and Interferences is whether this rejection is 
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proper in the present case, which has a filing date of January 27, 2000. Reversal of the Office 
Action's obviousness-type double patenting rejection is respectfully requested. 

B. Rejection of Claims 1-18 under 35 U.S.C. § 103(a) 

The Examiner rejected claims 1-18 under 35 U.S.C. § 103(a) as being unpatentable over 
Johnson et al, U.S. Patent No. 5,964,839 (hereinafter, "Johnson") and further in view of Togawa, 
U.S. Patent No. 6,240,530 (hereinafter, "Togawa"). This rejection is respectfully traversed. 

The factual inquiries that are relevant in the determination of obviousness are 
determining the scope and contents of the prior art, ascertaining the differences between the prior 
art and the claims in issue, resolving the level of ordinary skill in the art, and evaluating evidence 

of secondary consideration. KSR Int'l Co. v. Teleflex Inc. , 550 U.S. , 2007 U.S. LEXIS 

4745, at **4-5 (2007) ( citing Graham v. John Deere Co. of Kansas City , 383 U.S. 1, 17-18 
(1966)). To establish a prima facie case of obviousness, the prior art references "must teach or 
suggest all the claim limitations." M.P.E.P. § 2142. Moreover, the analysis in support of an 
obviousness rejection "should be made explicit" KSR , 2007 U.S. LEXIS 4745, at **37. 
"[Rejections on obviousness grounds cannot be sustained by mere conclusory statements; 
instead, there must be some articulated reasoning with some rational underpinning to support the 
legal conclusion of obviousness." Id ( citing In re Kahn , 441 F.3d 977, 988 (Fed. Cir. 2006)). 

Appellants respectfully submit that the claims at issue are patentably distinct from the 
cited references. The cited references do not teach or suggest all of the limitations in the claims. 

Claim 1 recites "accessing instructions that access observer data", and "observer data 
that includes data descriptive of an observer program." Claim 1 further recites "outputting 
instructions that obtain the results and provide the results for a user." Claim 1 also states 
"wherein the results generated indicate whether the observer program is present on the computer 
system." Johnson does not teach or suggest these claim elements. Johnson teaches a "system 
and method for the monitoring and collection of all inbound/outbound information activity and 
communications activity at a particular user location, for example, a household equipped with a 
variety of devices having communication capabilities." Johnson, Abstract. Indeed, the title of 
Johnson is "system and method for monitoring information flow and performing data 
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collection." Id., Title. From a reading of Johnson it appears that Johnson is a kind of system for 

monitoring devices, including computer use. The Examiner may assert that Johnson is a type of 

observer program itself, mentioned by Appellants in Appellants' patent specification. However 

Johnson does not teach or suggest all of the elements of the claimed invention and, at most, 

merely discloses a type of observer program. In further support of Johnson merely being some 

kind of observer, Johnson states the following: 

An object of the present invention is thus to provide a system and 
method for the monitoring and collection of all inbound/outbound 
information activity and communications activity at a particular 
user location, for example, a household equipped with a variety of 
devices having communication capabilities. . . . The information is 
collected in real-time, on an operation-by-operation basis, and is 
ultimately aggregated, for example, at the household level in a 
central location within the household. The aggregated data is 
thereafter transmitted to a central server for data analysis purposes. 

Id., Col. 2, lines 66-67, Col. 3, lines 1-4, 14-19. Johnson appears to be capable of monitoring or 

observing more than just a typical computer, as shown by the following: 

In accordance with an aspect of the present invention, aggregator 
20 will collect inbound and outbound information regarding the 
activities of various hardware devices such as a laptop computer 
22, personal computer 24, workstation 30, facsimile machine 26, 
information appliance 31, telephone 38, set top box 32, 
entertainment center 34 and television 36. These devices may, for 
example, be co-located within a single user household. The 
inbound and outbound activities being monitored include items 
such as on-line information service usage (e.g., Prodigy or 
CompuServe) and information regarding the facility used to 
engage the service (e.g., the Internet). In accordance with an aspect 
of the invention, the real-time interaction between a user and such 
a commercial on-line information service 50 is monitored to 
collect information , such as, but not limited to, type of services 
accessed by the user, time spent using each individual service, type 
and quantity of information downloaded by user, the time of day 
the user logged on the service, total connect time and data 
exchange rate. Advantageously, this real-time information is 
periodically collected from the individual devices being monitored 
by aggregator 20 and sent to server 10 where the data is analyzed 
to indicate certain user trends. 



Page 11 of 23 



Appl. No. 09/491,727 

Appeal Brief Dated July 24, 2007 

Reply to Office Action of March 9, 2007 

Id., Col. 4, lines 38-60. However, Johnson's abilities to observe and monitor various devices 

does nothing to help teach or suggest the following limitations from claim 1: "accessing 

instructions that access observer data," "observer data that includes data descriptive of an 

observer program," "outputting instructions that obtain the results and provide the results for a 

user," and "wherein the results generated indicate whether the observer program is present on the 

computer system." The Office Action cited Columns 12-14 of Johnson to support its assertion 

that Johnson taught these claim elements. However, as will be shown by Appellants, columns 

12-14 do not teach or suggest these claims elements either. 

Column 12, line 51 of Johnson (cited by the Office Action) states that "[djesktop activity 

is monitored by capturing key strokes and monitoring movement and use of the mouse or 

pointing device. The desktop activity monitor according to the present invention is capable of 

determining and storing the length of time that an application is active." Id., Col. 12, lines 51- 

55. Columns 13 and 14 of Johnson, also cited by the Office Action, further support Appellants' 

assertion that Johnson is merely some kind of snooper program itself. 

When the monitor interface program is loaded, it sets up and 
allocates data buffers and records for storing application activity 
data in memory, creates files for storing application activity data 
on disk and initializes and loads the infiltration module. Upon 
loading, the monitor interface program builds sets of records for 
the programs/applications that are currently loaded on the 
computer system. At set intervals, the monitor interface program 
takes a snapshot of the current list of loaded and active programs in 
the system. . . . 

The current application list is compared to the previous application 
list to determine if any applications have been added or removed. 
If an application has been added (loaded), a new record is created 
to hold the application's activity information and the record is 
added to the "active applications record list". If an application has 
been removed (unloaded) then the applications activity record is 
updated, the record is transferred to disk, and the entry is removed 
from the active application records list. 

When keystrokes are received, the infiltration module increments 
the keystroke counters and then passes the keystroke data to the 
target keyboard device driver. The keystroke counter is 
periodically polled by the monitor interface program to determine 
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if there has been any keyboard activity during a specified interval 
of time. 

Id., Col. 13, lines 54-63, Col. 14, lines 1-15. 

As shown, Johnson does not teach or suggest these claim elements from claim 1. 
Namely, claim 1 recites "accessing instructions that access observer data", and "observer data 
that includes data descriptive of an observer program." Claim 1 further recites "outputting 
instructions that obtain the results and provide the results for a user." Claim 1 also states 
"wherein the results generated indicate whether the observer program is present on the computer 
system." Johnson does not teach or suggest these claim elements. 

Claim 1 also recites "comparing instructions that compare the observer data with memory 
data read in from memory to determine whether the observer program is present on the computer 
system." The Office Action admits that Johnson does not teach or suggest this claim element. 
Office Action (mailed March 9, 2007), Page 5. However, Togawa also does not teach or suggest 
this claim element either. 

Togawa does not teach or suggest "comparing instructions that compare the observer data 

with memory data read in from memory to determine whether the observer program is present on 

the computer system." The Office Action has cited a portion of Togawa as teaching or 

suggesting this claim element. This portion of Togawa is as follows: 

According to a further aspect of the present invention, there is 
provided an information processing apparatus which includes a 
memory for storing programs and data for information processing 
and a processing section for executing the programs to perform 
various information processing, comprising a virus detection and 
identification section for detecting a computer virus which infects 
the information processing apparatus and identifying a type of the 
detected computer virus, a virus type information registration 
section for registering information regarding the type of the 
detected computer virus identified by the virus detection and 
identification section into a storage area which is access-disabled 
in an ordinary operation of the information processing apparatus, a 
trigger information outputting section for outputting trigger 
information so that the information processing apparatus may enter 
a processing mode for performing virus extermination, a stored 
information clearing section operable in response to the trigger 
information from the trigger information outputting section for 
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clearing information stored in all of those areas of the memory 
which are access-enabled in an ordinary operation of the 
information processing apparatus, an operating system fetching 
and starting up section for fetching an operating system from the 
outside and starting up the operating system after the stored 
information is cleared by the stored information clearing section, 
and a virus extermination section for exterminating, in operation 
environment of the operating system started up by the operating 
system fetching and starting up section, the computer virus which 
infects the memory of the information processing apparatus based 
on the information regarding the type of the detected virus 
registered in the virus type information storage section. 

Togawa, Col. 5, lines 7-38. 

This portion of Togawa does not teach or suggest "comparing instructions that compare 
the observer data with memory data read in from memory to determine whether the observer 
program is present on the computer system." This portion of Togawa identifies "virus detection 
and identification section for detecting a computer virus," "a virus type information registration 
section for registering information regarding the type of the detected computer virus identified 
by the virus detection," and "a virus extermination section for exterminating ... the computer 
virus." Later Togawa states that if "such an infecting computer virus is detected in the virus 
detection and identification step SI ... , then information stored in all of those areas of a 
memory ... is cleared in the memory clearing step S3." Togawa, Col. 8, lines 25-30. This 
simply does not teach or suggest "comparing instructions that compare the observer data with 
memory data read in from memory to determine whether the observer program is present on the 
computer system." This claim limitation requires all of the elements therein including (1) 
"comparing instructions that compare the observer data with memory data read in from 
memory," and (2) "to determine whether the observer program is present on the computer 
system." 

As shown, neither Johnson nor Togawa teach or suggest all of the limitations in claim 1 . 
As a result, Appellants respectfully request that the rejection of claim 1 be withdrawn. 
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As set forth above, neither Johnson nor Togawa teach or suggest all of the limitations in 
claim 1. Claims 2-15 depend directly or indirectly from claim 1. Thus, Appellants respectfully 
request that the rejection of claims 2-15 be withdrawn for at least the same reasons. 

As set forth above, neither Johnson nor Togawa teach or suggest all of the limitations in 
claim 1. Claims 16-18 include similar elements as identified above in the arguments with respect 
to claim 1. Thus, Appellants respectfully request that the rejection of claims 16-18 be withdrawn 
for at least the same reasons. 

Appellants respectfully assert that claims 1-18 are patentably distinct from the cited 
references. For the reasons discussed above, reversal of the Examiner's rejections and allowance 
of the pending claims is respectfully requested. 



Date: July 24, 2007 

Wesley L. Austin, Esq. 
Trapware Corporation 
1244 E. 1650 S. 
Bountiful, UT 84010 
Telephone: (801)296-0597 



Respectfully submitted, 




Wesley ly Austin ' 
Reg. No. 42,273 
Attorney for Appellant(s) 
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CLAIMS APPENDIX 
Listing of Claims involved in the appeal: 

1 . A system for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
on the computer system, the system including computer software for running on the computer 
system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 
being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to 
create a log file from the observing of the observer program; 
accessing instructions that access the observer data; 

reading instructions that read memory of the computer system to obtain memory data; 
comparing instructions that compare the observer data with memory data read in from 

memory to determine whether the observer program is present on the computer 

system; 

generating instructions that generate results from the comparing, wherein the results 
generated indicate whether the observer program is present on the computer 
system; and 

outputting instructions that obtain the results and provide the results for a user. 
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2. The system of claim 1 wherein the reading instructions read the memory of the computer 
system by querying the operating system of the computer system for the tasks running 
and by examining task information provided by the operating system. 



3. The system of claim 1 wherein the outputting instructions provide the results to a user through 
a graphical user interface. 



4. The system of claim 1 wherein the reading instructions read the memory of the computer 

system by querying the file system of the computer system for the files located on storage 
media and by examining file information provided by the file system. 



5. The system of claim 1 wherein the reading instructions read the memory of the computer 

system by opening a file located on storage media and by examining contents of the file. 



6. The system of claim 1 wherein the observer data includes data descriptive of a plurality of 
observer programs and wherein the system compares the observer data with the memory 
data to determine whether any known observer program is present. 



7. The system of claim 1 further comprising countermeasure instructions wherein the 
countermeasure instructions alter the operation of the observer program. 
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8. The system of claim 7 wherein the countermeasure instructions alter the operation of the 

observer program by observer program configuration data. 

9. The system of claim 7 wherein the countermeasure instructions alter the operation of the 

observer program by altering a file on the computer system. 

10. The system of claim 7 wherein the countermeasure instructions alter the operation of the 

observer program by altering reporting data generated by the observer program. 

1 1 . The system of claim 7 wherein the countermeasure instructions alter the operation of the 

observer program by replacing reporting data generated by the observer program. 

12. The system of claim 7 wherein the countermeasure instructions alter the operation of the 

observer program by replacing a file of the observer program. 

13. The system of claim 1 wherein the observer data includes data descriptive of observing 

activity typical of observing programs and wherein the system compares the observer 
data with the memory data to determine whether any known observer program is present. 

14. The system of claim 1 further comprising the observer data, wherein the observer data 

includes a list of files and modules that are part of the observer program software, and 
wherein the reading instructions read the memory of the computer system by querying 
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the operating system of the computer system for the tasks running and by examining task 
information provided by the operating system, and wherein the reading instructions also 
read the memory of the computer system by querying the file system of the computer 
system for the files located on storage media and by examining file information provided 
by the file system, and wherein the outputting instructions provide the results to a user 
through a graphical user interface. 

15. The system of claim 1 wherein the system is made available over a computer network 

through a web site. 

16. A system for detecting the presence of an observing program on a computer system, wherein 
the observing program is programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and to create data from the observing 
on the computer system, the system including computer software for running on the computer 
system, the system comprising: 

observer data that includes data descriptive of an observer program, the observer program 
being programmed to observe a user's activities on the computer system by 
monitoring user input entered through a user input device and also operating to 
create a log file from the observing of the observer program; 

means for accessing the observer data; 

means for reading memory of the computer system to obtain memory data; 
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means for comparing the observer data with memory data to determine whether the 

observer program is present on the computer system; 
means for generating results from the comparison, wherein the results generated indicate 

whether the observer program is present on the computer system; and 
means for outputting the results for a user. 

1 7. A method for detecting the presence of an observing program on a computer system, 
wherein the observing program is programmed to observe a user's activities on the computer 
system by monitoring user input entered through a user input device and to create data from the 
observing on the computer system, the method being implemented through computer software 
for running on the computer system, the method comprising the steps of: 

accessing observer data, the observer data including data descriptive of an observer 

program, the observer program being programmed to observe a user's activities 
on the computer system by monitoring user input entered through a user input 
device and also operating to create a log file from the observing of the observer 
program; 

reading memory of the computer system to obtain memory data; 

comparing the observer data with memory data read in from memory to determine 

whether the observer program is present on the computer system; 
generating results from the reading and comparing, wherein the results generated indicate 

whether the observer program is present on the computer system; and 
outputting the results for a user. 
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18. A computer-readable medium containing instructions for detecting the presence of an 
observing program on a computer system, wherein the observing program is programmed to 
observe a user's activities on the computer system by monitoring user input entered through a 
user input device and to create data from the observing on the computer system, wherein the 
instructions are executable to: 

access observer data, the observer data including data descriptive of an observer program, 
the observer program being programmed to observe a user's activities on the 
computer system by monitoring user input entered through a user input device and 
also operating to create a log file from the observing of the observer program; 
read memory of the computer system to obtain memory data; 

compare the observer data with memory data read in from memory to determine whether 

the observer program is present on the computer system; 
generate results from the read and compare, wherein the results generated indicate 

whether the observer program is present on the computer system; and 
output the results for a user. 
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EVIDENCE APPENDIX 



NONE. 
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RELATED PROCEEDINGS APPENDIX 



NONE. 
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